CVE-2025-22137: Pingvin Share Path Traversal Vulnerability

CVE-2025-22137 Overview

CVE-2025-22137 is a critical arbitrary file overwrite vulnerability affecting Pingvin Share, a self-hosted file sharing platform designed as an alternative to WeTransfer. This vulnerability allows an authenticated or unauthenticated user (when anonymous shares are enabled) to overwrite arbitrary files on the server, including sensitive system files, via crafted HTTP POST requests. The flaw stems from improper input validation in the file upload endpoint.

Critical Impact

Attackers can overwrite arbitrary files on the server including sensitive system configurations, application code, and critical operating system files, potentially leading to complete system compromise, denial of service, or remote code execution.

Affected Products

• Pingvin Share versions prior to 1.4.0

Discovery Timeline

• January 8, 2025 - CVE-2025-22137 published to NVD
• January 8, 2025 - Last updated in NVD database

Technical Details for CVE-2025-22137

Vulnerability Analysis

This vulnerability is classified under CWE-20 (Improper Input Validation). The file upload functionality in Pingvin Share fails to properly validate user-supplied input, allowing attackers to manipulate file paths and overwrite files outside the intended upload directory. The vulnerability is particularly dangerous because it can be exploited without authentication when anonymous shares are enabled, a common configuration for public file sharing instances.

The attack requires no special privileges and can be executed remotely over the network without any user interaction. Successful exploitation could result in unauthorized access to sensitive data, modification of application behavior through configuration file tampering, or complete denial of service by overwriting critical system files.

Root Cause

The root cause of this vulnerability lies in insufficient validation of file identifiers during the upload process. The application failed to verify that uploaded file identifiers were valid UUIDs before processing them, allowing attackers to inject path traversal sequences or arbitrary values that could redirect file writes to unintended locations on the filesystem.

Attack Vector

The attack is executed via HTTP POST requests to the file upload endpoint. An attacker crafts malicious requests containing specially crafted file identifiers that bypass the intended directory restrictions. When the server processes these requests, it writes the uploaded content to attacker-controlled paths, potentially overwriting system configurations, application files, or other sensitive data.

The vulnerability can be exploited in two scenarios:

1. Authenticated exploitation: Any registered user can leverage this flaw
2. Unauthenticated exploitation: When anonymous shares are enabled, no authentication is required

// Security patch adding UUID validation (Source: GitHub Commit)
 import * as mime from "mime-types";
 import { ConfigService } from "src/config/config.service";
 import { PrismaService } from "src/prisma/prisma.service";
+import { validate as isValidUUID } from "uuid";
 import { SHARE_DIRECTORY } from "../constants";
 
 @Injectable()

Source: GitHub Commit

The patch introduces UUID validation using the uuid library's validate function to ensure that file identifiers conform to the expected UUID format before processing, effectively preventing path manipulation attacks.

// Refactored file service to use fs promises (Source: GitHub Commit)
 } from "@nestjs/common";
 import { JwtService } from "@nestjs/jwt";
 import * as crypto from "crypto";
-import * as fs from "fs";
+import { createReadStream } from "fs";
+import * as fs from "fs/promises";
 import * as mime from "mime-types";
 import { ConfigService } from "src/config/config.service";
 import { PrismaService } from "src/prisma/prisma.service";

Source: GitHub Commit

Detection Methods for CVE-2025-22137

Indicators of Compromise

• Unusual file modifications in system directories or outside the designated share directory
• HTTP POST requests to file upload endpoints containing path traversal sequences (e.g., ../, ..%2f)
• Unexpected changes to application configuration files or critical system files
• Web server logs showing upload requests with non-UUID file identifiers

Detection Strategies

• Monitor file system integrity for unauthorized modifications outside the Pingvin Share data directory
• Implement web application firewall (WAF) rules to detect and block path traversal attempts in HTTP requests
• Review web server access logs for suspicious upload patterns or unusual request parameters
• Deploy file integrity monitoring (FIM) on critical system directories and application files

Monitoring Recommendations

• Enable detailed logging for the Pingvin Share application to capture all file upload activities
• Set up alerts for file creation or modification events in sensitive system directories
• Monitor for anomalous HTTP POST traffic patterns targeting file upload endpoints
• Implement real-time alerting for any changes to configuration files

How to Mitigate CVE-2025-22137

Immediate Actions Required

• Upgrade Pingvin Share to version 1.4.0 or later immediately
• Review file system integrity to identify any files that may have been modified by exploitation
• Temporarily disable anonymous shares if upgrading is not immediately possible
• Restrict network access to Pingvin Share instances until patching is complete

Patch Information

The vulnerability has been patched in Pingvin Share version 1.4.0. The fix implements proper UUID validation for file identifiers, ensuring that only valid UUIDs are accepted during the upload process. This prevents attackers from manipulating file paths to write outside the intended directory structure.

Security patches are available in the following commits:

• Commit 6cf5c66 - Adds UUID validation
• Commit c52ec71 - Refactors file service

For complete details, see the GitHub Security Advisory.

Workarounds

• Disable anonymous share functionality to require authentication for all uploads
• Implement network-level access controls to limit who can reach the Pingvin Share instance
• Deploy a reverse proxy with path traversal filtering capabilities
• Run Pingvin Share in a containerized environment with restricted filesystem access

# Configuration example - Disable anonymous shares in environment
ALLOW_ANONYMOUS_SHARES=false

# Restrict file permissions on share directory
chmod -R 750 /app/data/uploads
chown -R pingvin:pingvin /app/data/uploads